CVE-2024-54149
1 advisory.
Packagist/winter/wn-cms-module CVE-2024-54149: high 8.4, EPSS 0.42%
Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion
Action: Upgrade winter/wn-cms-module to 1.0.476 or later.
composer require winter/wn-cms-module:1.2.7composer require winter/wn-cms-module:1.1.11composer require winter/wn-cms-module:1.0.476Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.2.0 | 1.2.7 | - |
| 1.1.0 | 1.1.11 | - |
| 0 | 1.0.476 | - |
Fixed versions
| 1.2.7 | 1.1.11 | 1.0.476 |
Sources
- osv: GHSA-xhw3-4j3m-hq53
- https://github.com/wintercms/winter/security/advisories/GHSA-xhw3-4j3m-hq53
- https://nvd.nist.gov/vuln/detail/CVE-2024-54149
- https://github.com/wintercms/winter/commit/fb88e6fabde3b3278ce1844e581c87dcf7daee22
- https://github.com/wintercms/winter
CVE-2024-54149 · published · modified · JSON